Anomaly detection accuracy improved by optimizing without anomalies
Anomaly-Free Self-Optimization via AUC Bounds
Machine Learning
Summary
Anomaly detection tries to find rare unusual data, but it's hard to test because real anomalies are often missing during development. The authors develop a way to improve detection by directly optimizing a mathematical measure of accuracy (AUC) without needing real anomalies. They use made-up anomalies and adjust system settings continuously to get better at spotting unseen true anomalies. Their method works better than traditional ways across many data types and setups, and it is less affected by how fake anomalies are made.
What this means in practice
- •For security teams: Improve real-time anomaly detection systems without access to real anomalies during training.
- •For fraud analysis teams: Tune anomaly detection models for financial transactions using direct performance optimization for unseen frauds.
Authors
Kevin Wilkinghoff, Zheng-Hua Tan
Abstract
Anomalies are rare, and anomalous data are often unavailable during development, making it difficult to determine which anomaly detection models and configurations will generalize to unseen anomalies. Recent approaches address this challenge by generating pseudo-anomalies and using bounds on the achievable area under the ROC curve (AUC) to select the optimal configuration from a finite set of candidates. Instead, we use the AUC bound as a differentiable, anomaly-free objective for directly optimizing continuous parameters of anomaly detection systems. We demonstrate this framework by optimizing ensemble weights and introducing a learnable score-rescaling mechanism that adapts pseudo-anomaly scores, enabling optimization beyond a predefined candidate set. Experiments across multiple datasets and embedding models show that AUC-bound optimization achieves significant performance gains over conventional model selection and prior development-set-based parameter selection. The results further show that direct optimization is less sensitive to the choice of pseudo-anomaly construction.